From 595f9c4a09bedffab4d7f6dc95c7c7c2720412cb Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@gmx.de>
Date: Wed, 16 May 2012 16:12:11 +0200
Subject: [PATCH] jpg: missing malloc/realloc checks

---
 sys/src/cmd/jpg/ico.c     | 22 ++++++++++++++++++----
 sys/src/cmd/jpg/jpg.c     |  6 +++++-
 sys/src/cmd/jpg/readgif.c |  5 ++++-
 3 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/sys/src/cmd/jpg/ico.c b/sys/src/cmd/jpg/ico.c
index abd880539..135892ce9 100644
--- a/sys/src/cmd/jpg/ico.c
+++ b/sys/src/cmd/jpg/ico.c
@@ -103,6 +103,8 @@ transcmap(Icon *icon, int ncolor, uchar *map)
 	int i;
 
 	p = m = mallocz(sizeof(int)*(1<<icon->bits), 1);
+	if(m == nil)
+		sysfatal("malloc: %r");
 	for(i = 0; i < ncolor; i++){
 		*p++ = rgb2cmap(map[2], map[1], map[0]);
 		map += 4;
@@ -122,6 +124,8 @@ xor2img(Icon *icon, long chan, uchar *xor, uchar *map)
 
 	inxlen = 4*((icon->bits*icon->w+31)/32);
 	img = allocmemimage(Rect(0,0,icon->w,icon->h), chan);
+	if(img == nil)
+		return nil;
 
 	if(chan != CMAP8){
 		from = xor + icon->h*inxlen;
@@ -133,6 +137,11 @@ xor2img(Icon *icon, long chan, uchar *xor, uchar *map)
 	}
 
 	to = data = malloc(icon->w*icon->h);
+	if(data == nil){
+		freememimage(img);
+		return nil;
+	}
+
 	/* rotate around the y axis, go to 8 bits, and convert color */
 	mask = (1<<icon->bits)-1;
 	for(y = 0; y < icon->h; y++){
@@ -166,19 +175,20 @@ and2img(Icon *icon, uchar *and)
 
 	inxlen = 4*((icon->w+31)/32);
 	to = data = malloc(inxlen*icon->h);
+	if(data == nil)
+		return nil;
 
 	/* rotate around the y axis and invert bits */
 	outxlen = (icon->w+7)/8;
 	for(y = 0; y < icon->h; y++){
 		from = and + (icon->h - 1 - y)*inxlen;
-		for(x = 0; x < outxlen; x++){
+		for(x = 0; x < outxlen; x++)
 			*to++ = ~(*from++);
-		}
 	}
 
 	/* stick in an image */
-	img = allocmemimage(Rect(0,0,icon->w,icon->h), GREY1);
-	loadmemimage(img, Rect(0,0,icon->w,icon->h), data, icon->h*outxlen);
+	if(img = allocmemimage(Rect(0,0,icon->w,icon->h), GREY1))
+		loadmemimage(img, Rect(0,0,icon->w,icon->h), data, icon->h*outxlen);
 
 	free(data);
 	return img;
@@ -267,6 +277,10 @@ Bgeticon(Biobuf *b, Icon *icon)
 
 	/* convert the images */
 	icon->img = xor2img(icon, chan, xor, map2map);
+	if(icon->img == nil){
+		werrstr("xor2img: %r");
+		return -1;
+	}
 	icon->mask = nil;
 
 	/* check for and mask */
diff --git a/sys/src/cmd/jpg/jpg.c b/sys/src/cmd/jpg/jpg.c
index 5d76f6298..10c768299 100644
--- a/sys/src/cmd/jpg/jpg.c
+++ b/sys/src/cmd/jpg/jpg.c
@@ -169,7 +169,7 @@ vidmerge(Rawimage **aa1, Rawimage **aa2)
 		aao[i+1] = nil;
 		ao = aao[i] = malloc(sizeof(Rawimage));
 		if (ao == nil){
-			fprint(2, "jpg: vidmerge: realloc\n");
+			fprint(2, "jpg: vidmerge: malloc\n");
 			return nil;
 		}
 		memcpy(ao, a1, sizeof(Rawimage));
@@ -201,6 +201,10 @@ vidmerge(Rawimage **aa1, Rawimage **aa2)
 			uchar *po, *p1, *p2;
 
 			ao->chans[c] = malloc(ao->chanlen);
+			if (ao->chans[c] == nil){
+				fprint(2, "jpg: vidmerge: malloc chan\n");
+				return nil;
+			}
 			po = ao->chans[c];
 			p1 = a1->chans[c];
 			p2 = a2->chans[c];
diff --git a/sys/src/cmd/jpg/readgif.c b/sys/src/cmd/jpg/readgif.c
index df5f58de7..26b40c8da 100644
--- a/sys/src/cmd/jpg/readgif.c
+++ b/sys/src/cmd/jpg/readgif.c
@@ -156,7 +156,6 @@ readarray(Header *h)
 
 	if(h->fields & 0x80)
 		h->globalcmap = readcmap(h, (h->fields&7)+1);
-
 	array = malloc(sizeof(Rawimage**));
 	if(array == nil)
 		giferror(h, memerr);
@@ -180,8 +179,12 @@ readarray(Header *h)
 				new->cmaplen = 3*(1<<((new->fields&7)+1));
 				new->cmap = readcmap(h, (new->fields&7)+1);
 			}else{
+				if(h->globalcmap == nil)
+					giferror(h, "ReadGIF: globalcmap missing");
 				new->cmaplen = 3*(1<<((h->fields&7)+1));
 				new->cmap = malloc(new->cmaplen);
+				if(new->cmap == nil)
+					giferror(h, memerr);
 				memmove(new->cmap, h->globalcmap, new->cmaplen);
 			}
 			h->new = new;